Check Point said leaked files and chat logs from Luna Moth, also tracked as Silent Ransom Group and UNC3753, expose a ransomware operation that separates the person talking to the victim from the person driving the remote access tool. The material surfaced on an onion site in early October, and Check Point published its analysis on October 9.
The files show scripts, target-planning notes, and a split between persuaders and hands-on operators. One caller keeps the target calm while another quietly uses the remote session, which turns a phone-based help-desk impersonation into initial access for data theft and extortion.
For organizations that let staff grant remote support over the phone, the exposure is not just a rogue caller but a repeatable access workflow. That makes Luna Moth harder to treat as a single operator or a one-off scam, and it leaves the help desk and identity layer carrying the risk even when malware never appears.
Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings
Leaked documents suggest a multi-pronged operation, with social engineering and more technical attackers working together to manipulate a single target